If you would like to split by other fields , then you can add them to the by clause e.g. | stats sum(upload) as total by user,upload . However its not an aggregation over user but all other fields in by clause ... View more

If you would like to split by other fields , then you can add them to the by clause e.g. | stats sum(upload) as total by user,upload . However its not an aggregation over user but all other fields in by clause ... View more

Try setting this value in apps.conf show_in_nav = false ... View more

have you tried the option i have given above? by updating splunk-launch.conf? ... View more

Yes the location of splunk-launch.conf is in /opt/splunk/etc/. Reference : http://docs.splunk.com/Documentation/Splunk/6.4.3/Admin/Splunk-launchconf#splunk-launch.conf.spec # Note: this conf file is different from most splunk conf files. There is # only one in the whole system, located at # $SPLUNK_HOME/etc/splunk-launch.conf; further, there are no stanzas, # explicit or implicit. Finally, any splunk-launch.conf files in # etc/apps/... or etc/users/... will be ignored ... View more

If you want to bind your splunk instance to a particular ip rather than bind to default, then you can change it by setting SPLUNK_BINDIP parameter in splunk-launch.conf in etc folder of your splunk installation. CAUTION : When using this setting you must update mgmtHostPort in web.conf to match, or the command line and splunkweb will not know how to reach splunkd. SPLUNK_BINDIP=<ip address> * Specifies an interface that splunkd and splunkweb should bind to, as opposed to binding to the default for the local operating system. * If unset, Splunk makes no specific request to the operating system when binding to ports/opening a listening socket. This means it effectively binds to '*'; i.e. an unspecified bind. The exact result of this is controlled by operating system behavior and configuration. * NOTE: When using this setting you must update mgmtHostPort in web.conf to match, or the command line and splunkweb will not know how to reach splunkd. * For splunkd, this sets both the management port and the receiving ports (from forwarders). * Useful for a host with multiple IP addresses, either to enable access or restrict access; though firewalling is typically a superior method of restriction. * Overrides the Splunkweb-specific web.conf/[settings]/server.socket_host param; the latter is preferred when SplunkWeb behavior is the focus. * Defaults to unset. ... View more

As mentioned in the documents, either you have to contact your local splunk support to get a reset code or adjust the license pools if you have more than one ... View more

You can try running the below to find out which source, sourcetype or host is pushing more data index=_internal source=license_usage.log type=Usage | eval GB=b/1024/1024/1024 | timechart span=1d sum(GB) by st limit=20 Replace st with s,h,idx for source,host or index based breakdown More details here : http://docs.splunk.com/Documentation/Splunk/6.4.1/Admin/Aboutlicenseviolations ... View more

The license master can be any splunk instance to which your cluster can connect, normally search head or master (splunk doesn't recommend to user indexer node). We used CM as license master(physical machine) before but now moved to a separate license master which is out of our cluster infrastructure as part of infra movement not because of performance issues. As per http://wiki.splunk.com/Things_I_wish_I_knew_then , it's recommend to have a dedicated instance for deployment server and license master. Architecture/ Deployment Dedicated Deployment Server and license Master - If your install grows beyond just a single Splunk instance (talking indexers & search heads here, not forwarders), set up a separate server to be a license manager & Deployment server. A VM is fine for these purposes, and can actually be a benefit to be on a VM. You can even use the tarball install to put these multiple instances on the same box/VM. Say one in /opt/splunk, one in /opt/deploymentserver, and one in /opt/licenseserver. Run them on different ports of course. If you are not planning for a dedicated instance for this, you can use a search head or CM as license master ... View more

Try this index=os sourcetype=df |stats avg(<CPU FIELD> as AvgCPU by host,<process field>|sort 0 -Host,-AvgCPU |streamstats count as row by Host|where row==1 ... View more

Sorry but your config file shows 4662 as blacklist. Is it a typo? ... View more

If you have installed the JMX app on splunk instance, the configuration files are in SPLUNK_HOME/etc/apps/SPLUNK4JMX/default/inputs.conf where the sourcetype is mentioned as jmx by default. Moreover, in the JMX app the events should be already being fed into Splunk in best practice semantic format, key=value pairs , no additional field extractions are required. ... View more

Is your splunk enabled with ssl ? try telnet 10.10.20.103 9997 from forwarder and see if the connection is establlished ... View more

In your forwarder outputs.conf is there a typo for the port (9997 instead of 997) ? By mentioning Splunk's inputs.conf hope it's at receiver(indexer) . If that's the case you don't need to mention sourcetype and source. Please see below for your reference. At forwarder side Inputs.conf [default] host = bss [monitor:///var/log/snort/snort.log.*] index=snort_alert disabled = false sourcetype = snort_alert_full source = snort Outputs.conf [tcpout] defaultGroup =default-auto1b-group [tcpout:default-auto1b-group] server = 10.10.20.103:9997 At receiver / indexer side [default] host = Splunk # it should be your receiver host name [splunktcp://:9997] connection_host = bss # host_name for my forwarder [this is optional] ... View more

Add on is installed on almost all components but depends on your installation though. The installation and configuration details are available http://docs.splunk.com/Documentation/OPSEC-LEA ... View more

Not sure but start from here : http://docs.splunk.com/DocumentationStatic/WebFramework/1.2/compref_mvc.html or http://dev.splunk.com/webframework Please accept as answer if you are happy with the first answer so that the question will be marked as complete. Thank you ... View more